This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/spark-website.git
The following commit(s) were added to refs/heads/asf-site by this push:
new a5f7ad9d90 Document new security vulnerability in Apache Spark
a5f7ad9d90 is described below
commit a5f7ad9d9005980032b0bcb66819798fa0fb0049
Author: miqowhy <[email protected]>
AuthorDate: Wed Aug 5 12:20:34 2026 -0700
Document new security vulnerability in Apache Spark
Added details about CVE-2025-55039 vulnerability in Apache Spark, including
severity, affected versions, descriptions, mitigations, and credit.
Two remarks:
- I've taken the affected versions from holdenk
[description](https://lists.apache.org/thread/zrgyy9l85nm2c7vk36vr7bkyorg3w4qq),
but I think all newer versions are also affected
- For holdenk 2nd mitigation - I think setting spark.ssl.enabled=true is
not enough, you also need spark.ssl.rpc.enabled=true, at least that's what the
[documentation](https://spark.apache.org/docs/latest/security.html#ssl-configuration)
says
Author: miqowhy <[email protected]>
Author: Mikołaj Żurek <[email protected]>
Author: Holden Karau <[email protected]>
Closes #683 from miqowhy/patch-1.
---
security.md | 25 +++++++++++++++++++++++++
site/security.html | 30 ++++++++++++++++++++++++++++++
2 files changed, 55 insertions(+)
diff --git a/security.md b/security.md
index 5f3a549911..5996b20718 100644
--- a/security.md
+++ b/security.md
@@ -57,6 +57,31 @@ before loading or deploying a model.
<h2>Known security issues</h2>
+<h3 id="CVE-2025-55039">CVE-2025-55039: Apache Spark: RPC encryption defaults
to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext
modification attacks</h3>
+
+Severity: Moderate
+
+Vendor: The Apache Software Foundation
+
+Versions Affected:
+
+- Versions prior to 3.4.4, 3.5.2 and 4.0.0
+
+Description:
+
+Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default
network encryption cipher for RPC communication between nodes.
+When spark.network.crypto.enabled is set to true (it is set to false by
default), but spark.network.crypto.cipher is not explicitly configured, Spark
defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption
without authentication.
+This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC
traffic undetected by flipping bits in ciphertext, potentially compromising
heartbeat messages or application data and affecting the integrity of Spark
workflows.
+
+Mitigation:
+
+- Either configure `spark.network.crypto.cipher` to "AES/GCM/NoPadding" to
enable authenticated encryption or enable SSL encryption by setting both
`spark.ssl.enabled` and `spark.ssl.rpc.enabled` to "true", which provides
stronger transport security.
+
+Credit:
+
+- Holden Karau
+
+
<h3 id="CVE-2023-32007">CVE-2023-32007: Apache Spark shell command injection
vulnerability via Spark UI</h3>
This CVE is only an update to [CVE-2022-33891](#CVE-2022-33891) to clarify
that version 3.1.3 is also
diff --git a/site/security.html b/site/security.html
index 7a62101dfb..f864aaeadf 100644
--- a/site/security.html
+++ b/site/security.html
@@ -206,6 +206,36 @@ before loading or deploying a model.</p>
<h2>Known security issues</h2>
+<h3 id="CVE-2025-55039">CVE-2025-55039: Apache Spark: RPC encryption defaults
to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext
modification attacks</h3>
+
+<p>Severity: Moderate</p>
+
+<p>Vendor: The Apache Software Foundation</p>
+
+<p>Versions Affected:</p>
+
+<ul>
+ <li>Versions prior to 3.4.4, 3.5.2 and 4.0.0</li>
+</ul>
+
+<p>Description:</p>
+
+<p>Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default
network encryption cipher for RPC communication between nodes.
+When spark.network.crypto.enabled is set to true (it is set to false by
default), but spark.network.crypto.cipher is not explicitly configured, Spark
defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption
without authentication.
+This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC
traffic undetected by flipping bits in ciphertext, potentially compromising
heartbeat messages or application data and affecting the integrity of Spark
workflows.</p>
+
+<p>Mitigation:</p>
+
+<ul>
+ <li>Either configure <code class="language-plaintext
highlighter-rouge">spark.network.crypto.cipher</code> to
“AES/GCM/NoPadding” to enable authenticated encryption or enable
SSL encryption by setting both <code class="language-plaintext
highlighter-rouge">spark.ssl.enabled</code> and <code class="language-plaintext
highlighter-rouge">spark.ssl.rpc.enabled</code> to “true”, which
provides stronger transport security.</li>
+</ul>
+
+<p>Credit:</p>
+
+<ul>
+ <li>Holden Karau</li>
+</ul>
+
<h3 id="CVE-2023-32007">CVE-2023-32007: Apache Spark shell command injection
vulnerability via Spark UI</h3>
<p>This CVE is only an update to <a href="#CVE-2022-33891">CVE-2022-33891</a>
to clarify that version 3.1.3 is also
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
